How to configure Telegram to work through Squid HTTPS Proxy ???

Question

Squid

Good evening!
I really need help.
Maybe someone else has come across something similar.
A transparent Squid HTTPS Proxy has been deployed, everything works, there is access to the network, but the problem is, Telegram Desktop cannot connect.
How to allow Telegram Desktop to work?
For this problem I found only https://wiki.squid-cache.org/ConfigExamples/Chat/T...
But it didn't work. Maybe I'm doing something wrong? Or is there some other setting needed?

squid config:
acl localnet src 192.168.1.0/24
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

acl blacklist url_regex -i "/etc/squid/blacklist"

http_access allow localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow CONNECT
http_access deny blacklist
http_access allow all

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump options=ALL:NO_SSLv3:NO_SSLv2 connection-auth=off cert=/etc/squid/squid.pem
always_direct allow all
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

acl blacklist_ssl ssl::server_name_regex -i "/etc/squid/ blacklist_ssl"
acl whitelist_ssl ssl::server_name_regex -i "/etc/squid/whitelist_ssl"
acl step1 at_step SslBump1

ssl_bump peek step1
ssl_bump terminate blacklist_ssl

ssl_bump splice whitelist_ssl
acl NoSSLIntercept ssl::server_name_regex -i "/etc/squid/acl.url.nobump "
ssl_bump splice all

sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB

#cache_mem
512 MB
maximum_object_size_in_memory 512 KB
memory_replacement_policy lru
cache_dir aufs /var/spool/squid 2048 16 256

#Log
access_log daemon:/var/log/squid/access.log squid
logfile_rotate 30

coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20%
refresh_pattern 10 ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
refresh_pattern . 0 20% 4320

/usr/local/squid/etc/acl.url.nobump

# Telegram
149\.154\.1(6[0-9]|7[0-5])\.(25[0-5 ]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])
91\.108\.([4-7]|5[6|7])\.(25[0-5]|2[0-4][0-9]|1[0-9][0 -9]|[1-9]?[0-9])

Answer 1

And client banks work? With MIT? Apparently, no way, Durov certainly provided for MITM in the protocol.
PS
There is a workaround: Remove interception of ssl traffic.

Answer 2

I don't see the NoSSLIntercept ACL being applied.
Perhaps there is a fundamentally non-standard protocol, a tick like in QUIK (which simply drops the connection for any bumping attempt and that's it)

Answer 3

Is it possible to put Telegram MTProxy next to the squid ?

Answer 4

wrap traffic to tg servers past squid on the router